Re: segfault crash when loading certain rmail files

[Kenichi Handa <handa@etl.go.jp>]

I finally got a permission to contribute code again for
Emacs 21!

So, I can work on the following matter by myself.  If any of
you have already started to work on it, please let me know.

---
Ken'ichi HANDA
handa@etl.go.jp

Kenichi Handa <handa@etl.go.jp> writes:

> Ulf Rehmann <rehmann@mathematik.uni-bielefeld.de> writes:
>>  I turned out that the crash can be triggered, for emacs 21.2, by
>>  loading any file just containing the character (decimal) 128, if this
>>  file is gzipped and visited by find-file and if "automatic file
>>  de/compression" is toggled "on".

>>  No crash with emacs 20.7.

> Thank you for the report.  The following change will fix the
> problem.

> (1) Fix Fcall_process (in callproc.c).

> We have this code at line 786.

> 	      repeat_decoding:
> 		size = decoding_buffer_size (&process_coding, nread);
> 		decoding_buf = (char *) xmalloc (size);
		
> 		if (process_coding.cmp_data)
process_coding.cmp_data-> char_offset = PT;
		
> 		decode_coding (&process_coding, bufptr, decoding_buf,
> 			       nread, size);

> Before we check process_coding.cmp_data, if process_coding
> requires detection (we have the macro
> CODING_REQUIRED_DETECTION for checking it), we must call
> detect_coding.  And, if the resulting
> process_coding.composing is not COMPOSITION_DISABLED, we
> must allocate a memory for handling composition data (we
> have the function coding_allocate_composition_data, the
> second arg must be PT).

> (2) Fix detect_eol (in coding.c).

> We have this code at 4316

>   if (VECTORP (val) && XVECTOR (val)->size == 3)
>     {
>       int src_multibyte = coding->src_multibyte;
>       int dst_multibyte = coding->dst_multibyte;

>       setup_coding_system (XVECTOR (val)->contents[eol_type], coding);
coding-> src_multibyte = src_multibyte;
coding-> dst_multibyte = dst_multibyte;
coding-> heading_ascii = skip;
>     }

> The value of coding->cmp_data must be saved before calling
> setup_coding_system and restored after the call.


> And, we potentially have the same kind of problem in the
> following places (where, decode_coding is called directly).

> w16select.c:663:      decode_coding (&coding, htext, buf, truelen, bufsize);
> w32fns.c:6688:  decode_coding (&coding, lplogfont->lfFaceName, fontname,
> w32select.c:335:	decode_coding (&coding, src, buf, nbytes, bufsize);
> xselect.c:1651:	  decode_coding (&coding, data, buf, size, bufsize);
> xterm.c:10688:			    decode_coding (&coding, copy_bufptr, p,

> Fortunetly, for all those case, we can simply diable
> composition handling by setting the member `composing' of
> `struct coding_system' to COMPOSITION_DIABLED.  For example,
> in the case of xselect.c, before calling decode_coding at
> the line 335, what we need is to set coding.composing to
> COMPOSITION_DIABLED.

> Could someone please install a fix?  I'll verify the result.

> ---
> Ken'ichi HANDA
> handa@etl.go.jp


> _______________________________________________
> Emacs-devel mailing list
> Emacs-devel@gnu.org
> http://mail.gnu.org/mailman/listinfo/emacs-devel